I almost fell for it last year when I got an email like that, but I didn't know who it was from but the root website the card was supposedly sent from was legit so I went to it and lo and behold there was a warning posted.